open-show

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 0.1.3

Overview

OpenShow appears to be a real slideshow converter, but it needs Review because unsafe handling of fetched or local HTML can expose slideshow content when opened.

Review before installing. Use this only with trusted documents and public URLs, avoid automatic opening for untrusted HTML or web pages, and install dependencies in a virtual environment. The publisher should remove the insecure HTTPS retry, sanitize generated HTML, and add clear warnings for outbound URL and image fetching.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/openshow.py:132

Finding

Untrusted HTML Attributes Are Preserved in Automatically Opened Slideshow Output

Content

View full analysis

{inner}", text=text)) elif name in ("section", "article", "main", "figure", "figcaption"): for child in node.children: _walk(child) else: has_block_child = any(_is_block_child(c) for c in node.children) if has_block_child: for child in node.children: _walk(child) else: text = node.get_text(strip=True) if text: blocks.append(Block(type="other", html=str(node), text=text)) ``` The preserved markup is subsequently inserted directly into the generated document: ```python def _render_slide_content(slide: Slide) - ...[truncated 3241 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/openshow.py:279

Finding

HTTPS Requests Are Retried with TLS Certificate Verification Disabled

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Runtime Installation Uses Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file describes that remote images are automatically converted to data URIs and that web URLs are fetched and processed, but it does not warn users that supplying URL inputs will cause network requests to third-party hosts. For markdown files, behaviors affecting privacy or system/network activity should include a clear warning when user data or external content may be transmitted or retrieved.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly instructs use of shell commands, local file reads/writes, and network fetching, but declares no permission or allowed-tools boundary. That creates an authorization gap where a broadly capable skill can be invoked without clear least-privilege controls, increasing the chance of unintended file access, package installation, or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger set includes broad everyday phrases like '幻灯片' and '生成演示稿', which can cause accidental activation in unrelated conversations. When a skill can read local files, fetch URLs, and execute commands, overbroad triggering raises the risk of unintended privileged actions from ambiguous user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The activation rules describe when to trigger but do not define exclusion conditions, input trust boundaries, or when confirmation is required. In context, that ambiguity is risky because the skill can perform network fetches and local file processing, so unclear activation can lead to unintended handling of sensitive paths or URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill supports remote URLs and remote image fetching but does not prominently warn that it will make outbound requests and may download third-party resources. This can expose sensitive browsing targets, trigger SSRF-like access to internal endpoints if arbitrary URLs are allowed, and surprise users with privacy or network side effects.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

## 文件位置

- Skill 配置：`~/.hermes/skills/open-show/SKILL.md`
- 核心脚本：`~/.hermes/skills/open-show/scripts/openshow.py`
- Logo 资源：`~/.hermes/skills/open-show/assets/logo.svg`
- 输出目录：`~/openshow_outputs/`

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

When HTTPS fetching fails, the code retries with verify=False and suppresses the associated warning, disabling certificate validation. This permits man-in-the-middle interception and content tampering, which is especially dangerous because fetched HTML and images are then embedded into the generated slideshow and may contain attacker-controlled markup.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit use of verify=False disables TLS certificate verification for remote URL fetches. In the context of this skill, that means untrusted network attackers can alter imported web content before it is converted into HTML slides, increasing risk of malicious content injection and privacy compromise.

Content

Scanner excerpt · scripts/openshow.py (reported line 286)May include surrounding context.

python

except Exception:
        import urllib3
        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
        r = requests.get(url, headers=headers, timeout=20, verify=False)
        r.raise_for_status()
    r.encoding = r.apparent_encoding or "utf-8"
    soup = BeautifulSoup(r.text, "html.parser")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated HTML sets <html lang="zh-CN"> unconditionally, which forces a specific locale regardless of the user's input language or preferences. This is a natural-language policy concern because the file does not offer opt-in, selection, or explain why a China-specific locale is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a converter that produces a single playable HTML slideshow. Launching an external program through subprocess to open the result is not necessary to perform conversion itself and introduces an execution capability beyond the core document-to-slideshow purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openshow.py (reported line 936)May include surrounding context.

python

if args.openclaw:
        import subprocess
        try:
            subprocess.run(["openclaw", "browser", "open", file_url], check=False)
            print(f"已通过 openclaw 打开：{file_url}")
        except Exception as e:
            print(f"openclaw 打开失败：{e}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README shows CLI help and option descriptions entirely in Chinese, indicating a fixed language presentation. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.